严重 Linux Kernel 条件竞争导致本地提权漏洞（脏牛提权）
CVE编号
CVE-2016-5195利用情况
漏洞武器化补丁情况
官方补丁披露时间
2016-11-11漏洞描述
编译好的EXP下载地址： https://github.com/Brucetg/DirtyCow-EXP 该漏洞是 Linux 内核的内存子系统在处理写时拷贝（Copy-on-Write）时存在条件竞争漏洞， 导致可以破坏私有只读内存映射。黑客可以在获取低权限的的本地用户后，利用此漏洞获取 其他只读内存映射的写权限，进一步获取 root 权限。解决建议
厂商已发布了漏洞修复程序，请及时关注更新（或目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载）：https://bugzilla.redhat.com/show_bug.cgi?id=1384344受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_core | 15.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 12.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 16.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | linux | linux_kernel | * | From (including) 2.0.0 | Up to (excluding) 4.8.3 | ||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_aus | 6.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_aus | 6.4 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_aus | 6.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_eus | 6.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_eus | 6.7 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_eus | 7.1 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_long_life | 5.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_long_life | 5.9 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_tus | 6.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_5 | kernel | * | Up to (excluding) 0:2.6.18-416.el5 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_6 | kernel | * | Up to (excluding) 0:2.6.32-642.6.2.el6 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | kernel-rt | * | Up to (excluding) 0:3.10.0-327.36.3.rt56.238.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12 | kernel-default-extra | * | Up to (excluding) 4.4.21-69 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_12.04.5_lts | linux | * | Up to (excluding) 3.2.0-115.157 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04.6_lts | linux | * | Up to (excluding) 3.13.0-100.147 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04.7_lts | linux | * | Up to (excluding) 4.4.0-45.66 | |||||
- 攻击路径 本地
- 攻击复杂度 容易
- 权限要求 无需权限
- 影响范围 全局影响
- EXP成熟度 漏洞武器化
- 补丁情况 官方补丁
- 数据保密性 数据泄露
- 数据完整性 传输被破坏
- 服务器危害 服务器失陷
- 全网数量 N/A
| CWE-ID | 漏洞类型 |
| CWE-362 | 使用共享资源的并发执行不恰当同步问题（竞争条件） |
Exp相关链接
- https://github.com/acidburnmi/CVE-2016-5195-master
- https://github.com/aishee/scan-dirtycow
- https://github.com/arbll/dirtycow
- https://github.com/ASRTeam/CVE-2016-5195
- https://github.com/BrolyCode/Dirty-COW-CVE-2016-5195-
- https://github.com/Brucetg/DirtyCow-EXP
- https://github.com/DanielEbert/CVE-2016-5195
- https://github.com/DavidBuchanan314/cowroot
- https://github.com/dirtycow/dirtycow.github.io
- https://github.com/droidvoider/dirtycow-replacer
- https://github.com/dulanjaya23/Dirty-Cow-CVE-2016-5195-
- https://github.com/esc0rtd3w/org.cowpoop.moooooo
- https://github.com/firefart/dirtycow
- https://github.com/FloridSleeves/os-experiment-4
- https://github.com/gbonacini/CVE-2016-5195
- https://github.com/hyln9/VIKIROOT
- https://github.com/imfiver/CVE-2022-0847
- https://github.com/imust6226/dirtcow
- https://github.com/istenrot/centos-dirty-cow-ansible
- https://github.com/jas502n/CVE-2016-5195
- https://github.com/KaviDk/dirtyCow
- https://github.com/KosukeShimofuji/CVE-2016-5195
- https://github.com/ldenevi/CVE-2016-5195
- https://github.com/linhlt247/DirtyCOW_CVE-2016-5195
- https://github.com/ndobson/inspec_CVE-2016-5195
- https://github.com/nu11secur1ty/Protect-CVE-2016-5195-DirtyCow
- https://github.com/oleg-fiksel/ansible_CVE-2016-5195_check
- https://github.com/pgporada/ansible-role-cve
- https://github.com/r1is/CVE-2022-0847
- https://github.com/roliboy/dirty-cow-toolkit
- https://github.com/roliboy/rootcow
- https://github.com/scumjr/dirtycow-vdso
- https://github.com/shanuka-ashen/Dirty-Cow-Explanation-CVE-2016-5195-
- https://github.com/sideeffect42/DirtyCOWTester
- https://github.com/sribaba/android-CVE-2016-5195
- https://github.com/timwr/CVE-2016-5195
- https://github.com/titanhp/Dirty-COW-CVE-2016-5195-Testing
- https://github.com/whu-enjoy/CVE-2016-5195
- https://github.com/xlucas/dirtycow.cr
- https://github.com/xpcmdshell/derpyc0w
- https://github.com/zakariamaaraki/Dirty-COW-CVE-2016-5195-
- https://gitlab.com/nu11secur1ty/Protect-CVE-2016-5195-DirtyCow
- https://www.exploit-db.com/exploits/40611
- https://www.exploit-db.com/exploits/40616
- https://www.exploit-db.com/exploits/40838
- https://www.exploit-db.com/exploits/40839
- https://www.exploit-db.com/exploits/40847
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论